CVE-2005-1295: include.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument.

Security readout for executives and security teams

CVE-2005-1295 describes an include.cgi script that may let remote attackers read arbitrary files when a full pathname is supplied as an argument. The public bundle does not identify a vendor, product, versions, CVSS score, or vendor patch, so exposure must be verified by finding whether this specific CGI script exists in your environment. Likely limited to externally reachable or internally reachable web servers running the vulnerable include.cgi script. The source bundle lists affected vendor/product/versions as n/a, so internet exposure cannot be inferred from product inventory alone. Treat this as an exposure discovery task rather than a broad emergency. If include.cgi is present on reachable systems, prioritize containment because arbitrary file read can expose credentials, configuration, or sensitive data. Mitigation focus: Identify and remove unused include.cgi deployments from public and internal web servers.; Restrict access to any required include.cgi script pending vendor or owner guidance.; Review application code for full-path file inclusion from request parameters..

Prepared

Jun 29, 2026, 22:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.